# Amazon Root CA 1 root certificate (Amazon Trust Services) > Amazon Root CA 1 is a root CA certificate operated by Amazon Trust Services (RSA 2048, valid until 2038-01-17, SHA-256 8ECDE688). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft. Source: https://ssl.sh/roots/amazon-root-ca-1/ Last updated: 2026-11-10 Amazon Root CA 1 is a root CA certificate operated by Amazon Trust Services (RSA 2048, valid until 2038-01-17, SHA-256 8ECDE688). As of the latest CCADB data it is trusted for TLS server authentication by 4 of 4 major root stores: Chrome, Mozilla, Apple, Microsoft. | Field | Value | |---|---| | CA owner | Amazon Trust Services | | Subject | CN=Amazon Root CA 1,O=Amazon,C=US | | SHA-256 | 8ECDE6884F3D87B1125BA31AC3FCB13D7016DE7F57CC904FE1CB97C6AE98196E | | SPKI SHA-256 | FBE3018031F9586BCBF41727E417B7D1C45C2F47F93BE372A17B96B50757D5A2 | | Valid from | 2015-05-26 | | Expires | 2038-01-17 | | Key | RSA 2048 | | Signature algorithm | sha256WithRSAEncryption | | Serial number | 66C9FCF99BF8C0A39E2F0788A43E696365BCA | | SHA-1 (Windows thumbprint) | 8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16 | ## Root store status | Root store | Status | Trusted for TLS | Distrust for TLS after | Details | |---|---|---|---|---| | Chrome | Included | Yes | - | - | | Mozilla | Included | Yes | - | Trust bits: Websites; EV policy OIDs: not EV-enabled; First included in: NSS 3.28.1 / Firefox 51; Inclusion bug: #1172401 | | Apple | Included | Yes | - | Trust bits: serverAuth, clientAuth, emailProtection | | Microsoft | Included | Yes | - | Trusted EKUs: Server Authentication, Client Authentication, Document Signing, Encrypting File System, Secure Email, Time Stamping | The CCADB lists EV policy OID 2.23.140.1.1 for this root, but Mozilla does not mark it as EV-enabled. ## Intermediate CAs issued by this root The CCADB lists 33 intermediate CA certificates signed directly by Amazon Root CA 1: 27 currently valid, 0 expired and 6 revoked (revoked includes those whose parent was revoked). | Intermediate | Operated by | Expires | Status | SHA-256 | |---|---|---|---|---| | Amazon RSA 2048 S24 | Amazon Trust Services | 2029-07-07 | Valid | E052B6CC2F2C2A872CCB1BF3F73D99CEB2BAEDFD4886C5452B57F7B89CD4BC8F | | Amazon RSA 2048 S21 | Amazon Trust Services | 2029-07-07 | Valid | B06193B2656F9003EDDA43F4B5C07A0280ADB2B6B482E2280955FC9E3B3EBBCE | | Amazon RSA 2048 S14 | Amazon Trust Services | 2029-07-07 | Valid | AFF34C5497195F13C8A9A5D09B6AF21364DC1F3813ECF94EED0DAB683E15F97F | | Amazon RSA 2048 S22 | Amazon Trust Services | 2029-07-07 | Valid | A6DA77CCC7F604F7C56F0C4921A9EDFEC279CEF1B93D2FBD3D0BDA5AAED72440 | | Amazon RSA 2048 S20 | Amazon Trust Services | 2029-07-07 | Valid | 8E5DE9110E08E11B0D3A566AFD0A762780A39660CF6B9339336DD51EE1FA9317 | | Amazon RSA 2048 S18 | Amazon Trust Services | 2029-07-07 | Valid | 7529A73C4D0F371A9C76AFB443374960B9969CAF431FDF5A15EB7028D40078B0 | | Amazon RSA 2048 S12 | Amazon Trust Services | 2029-07-07 | Valid | 52EB389BBDC400BC0A93C2D7713AE893137EE7A8DBC418C74F43D49619B1FB91 | | Amazon RSA 2048 S25 | Amazon Trust Services | 2029-07-07 | Valid | 3A42E35D012808C29EDCD08A8E51E9838A771ABCFE3B82CBB89A7ADA930BA3A5 | | Amazon RSA 2048 S15 | Amazon Trust Services | 2029-07-07 | Valid | 351ABB5189DCE3ACD5E0484A8B6AECD5D775F37692702150E20ED309FB5F8B03 | | Amazon RSA 2048 S16 | Amazon Trust Services | 2029-07-07 | Valid | 33D789BD96B40709982E9B88C6BFCF742D6610D0F9A322B620B24FC6E7B9E49E | | Amazon RSA 2048 S13 | Amazon Trust Services | 2029-07-07 | Valid | 2EE796CC437A9E971FD3B67B737242012773D87B9289DAA9E13F7EA32708A22F | | Amazon RSA 2048 S23 | Amazon Trust Services | 2029-07-07 | Valid | 235EF6809CAFF0EC5A0F1EDC36FB52CCDC328B5A4CC4630DAAA8839B387A836E | | Amazon RSA 2048 S17 | Amazon Trust Services | 2029-07-07 | Valid | 1803A03804B1B20BD6B064E6574978942F8EF6FCF2AFCF28CF516F382F8DEC47 | | Amazon RSA 2048 S19 | Amazon Trust Services | 2029-07-07 | Valid | 04091B1D552BF3556E2823479BF2A4E7F2DE3013895F9837FBE697FB7D4C1EA8 | | Amazon RSA 2048 S11 | Amazon Trust Services | 2029-04-21 | Valid | FE5030D0B4CFA4DE1E286E75B5E4716271F1A4789CF546C485179F9FAE57FE01 | | Amazon RSA 2048 S09 | Amazon Trust Services | 2029-04-21 | Valid | E5A09008CF8BF271E25FEA61127B9F4F2E4AAA4102CB59AD5EDEBC3A0FB8F4AB | | Amazon RSA 2048 S06 | Amazon Trust Services | 2029-04-21 | Valid | BA1987F4BB1612406C414FAD60AA69332B6ED0B96FC7A99F9F690B69D78E8766 | | Amazon RSA 2048 S10 | Amazon Trust Services | 2029-04-21 | Valid | A38B75A1866AFFBDBD6FB6653214C09F13E3F3B3248E5B098FD6240A0B21F373 | | Amazon RSA 2048 S08 | Amazon Trust Services | 2029-04-21 | Valid | 62E81C6805A0A23A1F946171DF0423B4A427399E0947A516918EE96F11F984CC | | Amazon RSA 2048 S07 | Amazon Trust Services | 2029-04-21 | Valid | 2AB22EA330338D0DD1F4562DD52E352DD00331CF330507B9C76DD0603733812C | ## Cross-signed versions 2 certificate(s) in the CCADB have the same subject and public key as Amazon Root CA 1 but a different issuer. A server can send one of them so that clients which trust the issuing root, but not Amazon Root CA 1, can still build a chain. | Signed by | CA owner | Expires | Status | SHA-256 | |---|---|---|---|---| | Starfield Services Root Certificate Authority - G2 | Amazon Trust Services | 2037-12-31 | Valid | 87DCD4DC74640A322CD205552506D1BE64F12596258096544986B4850BC72706 | | Starfield Services Root Certificate Authority - G2 | Amazon Trust Services | 2037-12-31 | Valid | 391220705B75BCF3ED3CD4B3631213F569D2CF8226101E170799A5354AB12861 | ## What happens when it expires Amazon Root CA 1 is valid until 2038-01-17, about 11.2 years after this data snapshot (2026-11-10). From that day, browsers and operating systems that check trust-anchor expiry stop accepting chains that end at this root, so any certificate that can only chain to it fails validation. Android is a known exception: it does not enforce the expiry date of trust anchors. ## FAQ **Is Amazon Root CA 1 trusted by Chrome, Firefox, Safari and Windows?** Yes. As of 2026-11-10, Chrome, Mozilla (Firefox), Apple (Safari) and Microsoft (Windows) all trust it for TLS server authentication. **When does Amazon Root CA 1 expire?** On 2038-01-17, about 11.2 years after the 2026-11-10 data snapshot. **How many intermediate certificates has Amazon Root CA 1 issued?** The CCADB lists 33: 27 valid, 0 expired and 6 revoked. The newest valid one is Amazon RSA 2048 S24, valid until 2029-07-07. **Is Amazon Root CA 1 cross-signed?** Yes. The CCADB has 2 cross-certificate(s) with its subject and key, signed by Starfield Services Root Certificate Authority - G2; 2 of them are still valid. Sources: CCADB TLS Server Authentication report, All Included Root Certificate Trust Bit Settings, All Certificate Information (V5), the per-store TLS reports and Mozilla's Included CA Certificate Report (ccadb.org/resources).